4 ms·
Windows do not log the passwords they tried, so we can't know which ones were used Would be interesting to create a server daemon that listens on TCP port 3389
by 300bps 4y ago
Windows do not log the passwords they tried, so we can't know which ones were used
Would be interesting to create a server daemon that listens on TCP port 3389 and implements the login portion of the RDP protocol to 1) Be able to gather information about the passwords used and 2) Experiment with ways to lock up or stall the scanners.
- h4waii 4y agoA few links which provide some good insight for your idea. https://research.nccgroup.com/2021/10/21/cracking-rdp-nla-supplied-credentials-for-threat-intelligence/ https://research.nccgroup.com/2021/10/21/cracking-rdp-nla-su... https://github.com/nccgroup/nlahoney https://github.com/nccgroup/nlahoney